Buffer Overflow Vulnerability in GPAC Project's MP4Box Product
CVE-2025-60475

5.5MEDIUM

Key Information:

Vendor

GPAC Project

Status
MP4Box
Vendor
CVE Published:
20 October 2026

What is CVE-2025-60475?

The GPAC Project's MP4Box product is impacted by a buffer overflow vulnerability located in the gf_ac4_parser_bs function within av_parsers.c. This flaw can be exploited by attackers through the delivery of specially crafted inputs, leading to a Denial of Service (DoS). It is crucial for users of MP4Box versions prior to 2.5 to be aware of this vulnerability and consider updating their software to ensure security and stability.

References

https://github.com/gpac/gpac/commit/e02d1fd24cdc26acb1b23...
https://github.com/gpac/gpac/issues/3291
https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Bo...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.